Re: Clean sheet security design suggestions?

2011-06-01 Thread Kalle Korhonen
Yeah, same here on JAAS - it's good for locking parts of the codebase if you really needed to but way too cumbersome for web app security. Heh, as the committer and maintainer both in Tynamo and Shiro, I kind of have to recommend them. Kalle On Wed, Jun 1, 2011 at 2:35 PM, Lenny Primak wrote: >

Re: Clean sheet security design suggestions?

2011-06-01 Thread Lenny Primak
The closest to CMA that I've used was JAAS. I didn't like it. Sounds like you are recommending tynamo and shiro. On Jun 1, 2011, at 5:19 PM, Kalle Korhonen wrote: > I see - should have said I assume you are using CMA. I'm biased of > course, but when ever I've used CMA, I've found it too cum

Re: Clean sheet security design suggestions?

2011-06-01 Thread Kalle Korhonen
I see - should have said I assume you are using CMA. I'm biased of course, but when ever I've used CMA, I've found it too cumbersome and limiting. Kalle On Wed, Jun 1, 2011 at 2:03 PM, Lenny Primak wrote: > Thanks!  I am not using CMA actually, it is JSP home-grown security, > which I am lookin

Re: Clean sheet security design suggestions?

2011-06-01 Thread Lenny Primak
Thanks! I am not using CMA actually, it is JSP home-grown security, which I am looking to replace. In your opinion, should I look use CMA or go with tynamo & shiro? I guess I can do a bake-off but I would rather not. On Jun 1, 2011, at 4:29 PM, Kalle Korhonen wrote: > The big three for Java ar

Re: Clean sheet security design suggestions?

2011-06-01 Thread Mark
Keep in mind that Tynamo's security package is Apache Shiro (http://shiro.apache.org/) with additions that make it easy to work with Tapestry. If you want something that isn't Tapestry specific, take a look at Shiro by itself. If you are wanting other Tapestry options, look at: http://code.google.

Re: Clean sheet security design suggestions?

2011-06-01 Thread Kalle Korhonen
The big three for Java are CMA (Container Managed Authentication) which you are using, Spring Security (ex-Acegi Security, Tapestry integration provided by tapestry-spring-security module) and Apache Shiro (ex-JSecurity, Tapestry integration provided by Tynamo's tapestry-security). I've spent more

Re: Clean sheet security design suggestions?

2011-06-01 Thread Lenny Primak
Thanks guys I'll definitely look at tynamo security. There is a lot of homegrown code in our implementation that feels like it should be a part of a framework that's already been written. I guess that tynamo security is that framework. Anything else I should be l should be looking at in this s

Re: Clean sheet security design suggestions?

2011-06-01 Thread Mark
Definitely look at Tynamo's tapestry-security which uses Shiro and the tynamo-federatedaccounts add on. I believe you can have multiple types of authentication simply by contributing different entity realms. It has built in support for Facebook and OpenId is coming. Mark On Wed, Jun 1, 2011 at 1

Re: Clean sheet security design suggestions?

2011-06-01 Thread Thiago H. de Paula Figueiredo
On Wed, 01 Jun 2011 14:33:47 -0300, Lenny Primak wrote: My current project is to refresh a client's web site using tapestry. The web site currently uses JSP. We have a JEE/web service backend that uses JPA/EJB3.1 which we will continue to use. We now have a JEE based authorization service

Clean sheet security design suggestions?

2011-06-01 Thread Lenny Primak
My current project is to refresh a client's web site using tapestry. The web site currently uses JSP. We have a JEE/web service backend that uses JPA/EJB3.1 which we will continue to use. We now have a JEE based authorization service API based on plain method calls now. What we want is to k